PHP2Shell

CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell . Their existence was publicly announced on 20 October 2026. [ 1 ] An emergency patch and details the vulnerabilities were released on the following day. [ 2 ]

The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc . [ 3 ] According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected. [ 4 ]

The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, [ 5 ] while security firm watchTowr rated it a full 10.0. [ 6 ]

The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5. [ 2 ] Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life . [ 2 ] Both vulnerabilities were published through GitHub security advisories [ 7 ] [ 8 ] on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter.

The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and was confirmed by the X account of cybersecurity company watchTowr labs. [ 9 ] The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. [ 9 ] [ 1 ] One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". [ 10 ] PoCs , write-ups, and partial mitigations started circulating on the Internet before the end of the embargo. [ 6 ] [ 11 ]

Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. [ 12 ] [ 13 ]

Following advice from CERT -EU and the British National Cyber Security Centre , many organizations across Europe took their websites offline as a precaution while the patches were pending. [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ]

1 2 "PHP: News Archive - 20 Oct 2026" . . 2026-10-20 . Retrieved 2026-10-21 .

1 2 3 "PHP: News Archive - 21 Oct 2026" . . 2026-10-21 . Retrieved 2026-10-21 .

↑ "Patch the Planet: global response coordination as agents uncover critical vulnerabilities" . OpenAI (Press release). 21 October 2026 . Retrieved 21 October 2026 .

↑ "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" . Retrieved 2026-10-21 .

↑ "php.announce: [ ANNOUNCE ] Upcoming Critical PHP Security Release" . news-web.php.net . Retrieved 2026-10-21 .

1 2 Abrams, Lawrence. "PHP warns admins of two critical flaws, emergency patches coming tomorrow" . BleepingComputer . Retrieved 2026-10-21 .

↑ "RCE via OOM corruption" . 2026-10-21 . Retrieved 2026-10-21 .

↑ "RCE via stale global state" . 2026-10-21 . Retrieved 2026-10-21 .

1 2 Khandelwal, Swati (21 October 2026). "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert" . The Hacker News . Retrieved 21 October 2026 .

↑ Goodin, Dan (2026-10-21). "PHP warns it plans to release 2 emergency patches imminently" . Ars Technica . Archived from the original on 2026-10-21 . Retrieved 2026-10-21 .

↑ "Only for the curious..." jackalsyn.com . Retrieved 2026-10-21 .

↑ Knecht, Dane (21 October 2026). "Dane Knecht 🦭 (@dok2001) on X" . X (formerly Twitter) .

↑ "Hold on to your butts: Web admins braced for emergency PHP updates to plug leaked exploits" . PC Gamer . 2026-10-21 . Retrieved 2026-10-21 .

↑ Satter, Raphael; Pardesi, Rajveer; Marchandon, Leo; Satter, Raphael; Marchandon, Leo (2026-10-21). "Government websites go dark as software flaw sparks security scramble" . Reuters . Retrieved 2026-10-21 .

↑ "Websites taken down as critical PHP cyber-security update issued" . . 2026-10-21 . Retrieved 2026-10-21 .

↑ "Major websites go offline as critical PHP vulnerability triggers security fears" . The Brussels Times . Retrieved 2026-10-21 .

↑ Collier, Kevin (October 21, 2026). "Critical vulnerabilities in commonly used web code spark rush to update systems" . NBC News.

↑ "Critical security issue affecting PHP" (Press release). National Cyber Security Centre. October 20, 2026.

Announcement by the PHP Project

Timeline of security hacking incidents

Timeline of computer viruses and worms

Twitter account hijacking

European Medicines Agency data breach

United States federal government data breach

Windows XP Service Pack 1 and Server 2003 RTM source code leaks

Microsoft Exchange Server breach

Ivanti Pulse Connect Secure data breach

Colonial Pipeline ransomware attack

Health Service Executive ransomware attack

Waikato District Health Board ransomware attack

JBS S.A. ransomware attack

Kaseya VSA ransomware attack

Transnet ransomware attack

National Rifle Association ransomware attack

Iranian fuel cyberattack

Red Cross data breach

Anonymous and the Russian invasion of Ukraine

DDoS attacks on Romania

Costa Rican ransomware attack

Shanghai police database leak

Grand Theft Auto VI content leak

Munster Technological University ransomware attack

Insomniac Games data breach

Operation Triangulation cyberattack

British Library cyberattack

Kadokawa and Niconico

Change Healthcare ransomware attack

Ukrainian cyberattacks against Russia

Fur Affinity domain hijacking

IRLeaks attack on Iranian banks

Internet Archive data breach

2024 global telecommunications hack

2024 National Public Data breach

Cyberattacks on Bank Sepah

2025 Paraguay ransomware attack

4chan hacking and data breach

2025 St. Paul cyberattack

Jaguar Land Rover cyberattack

Collins Aerospace cyberattack

2025 cyberattack on Polish power grid

Aura (security) data breach

ManageMyHealth data breach

Neighbourly data breach

Cyberwarfare during the 2026 Iran war

Cyberattacks by rogue OpenAI agents Hugging Face Medicare

2026 Minnesota water system cyberattack

Meccha Chameleon malware incident

Grand Theft Auto VI content leak

French supermarket refrigerator hack

Anonymous associated events

Google DeepMind Google AI

PrintNightmare (2021)

Account pre-hijacking (2022)

Computer security exploits

Software engineering stubs

Articles with short description

Short description is different from Wikidata

Current events from October 2026